Skip to Content.
Sympa Menu

baslinux - Re: [BL] nmap and security 26

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: Karolis Lyvens <karolisl AT gmail.com>
  • To: lforrestster AT gmail.com, baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] nmap and security 26
  • Date: Sun, 28 Jan 2007 23:26:06 +0200

On Sun, Jan 28, 2007 at 12:14:34PM +0000, Lee Forrest wrote:
-snip-
> That's garbage. Makes it look like I'm running an incredibly busy
> server with an excellent firewall. I don't have most of those
> apps on this box. In fact, I've never even _heard_ of most of
> them. And I'm not running any network daemons/(super)servers. I
> have an FTP server, but it's not up.

It might have been you. "Filtered" ports mean this:

It (scanner) sent a packet to this port, but got back nothing. Meaning
that packets were simply dropped on floor (not replied to). In contrast
to this, "closed" port means that it is unused and, when trying to access
this port, ICMP "REJECT" packet was received (sent to scanner from that
host). Opened port means that a normal reply was gotten from that port.

On nmap, if you use "-P0", ie, omit ping test, you'll get ALL ports
"filtered", although the host isn't even up.

These "filtered" ports tend to confuse this mailing list :)

So, in short, "filtered" port means that the port is unused and no reply
was gotten from it

> I wouldn't use this site. It could get you in trouble. They could
> have nmap configured to give _your_ IP as the origin of the
> probe. Such capabilities are strongly-implied in the man page.

That site only allows your IP to be scanned. Excerpt from FAQ:

-----
4. How about a port scanner?

A port scanner is a great security tool. It is one of the first things you
would want
to do after a new bastion host comes on line. The problems are several. Port
scanning
can be used by those with bad intentions to locate vulnerable systems. Port
scanning will
often annoy system administrators by setting off intrusion alarms, triggering
IDS
systems, causing "paging in the middle of the night" automatic IP blocking,
snmp trap
alarms and lot of other issues.
If I can devise a way to overcome ( or at least greatly diminish ) these
issues...
a port scanner may well be added to the existing tools.

On 5 July 2003 Added port scanner. It will only scan the connected/requesting
host.
If no security issues develope it will stay and more features may be added as
time allows.
-----

Karolis




Archive powered by MHonArc 2.6.24.

Top of Page